Reaching the web UI from another machine sends an Origin header naming
this host rather than localhost, and Sunshine's CSRF check rejects it:
Web UI: [10.0.0.8] -- CSRF protection blocked request from origin:
https://10.0.0.2:47990
csrf_allowed_origins takes a comma-separated list of bare origins, NOT a
JSON array — brackets and quotes are rejected entry by entry, which is how
the first attempt failed. Both the IP and hostname spellings are listed
because the browser sends whichever was typed.
origin_web_ui_allowed=lan set explicitly alongside it, so the two settings
that gate remote access to the UI are stated in one place.
connor
c6edf78545